Cybersecurity Glossary A–Z

The policies and mechanisms that determine who can access what resources and what actions they can perform. The three core models: DAC (Discretionary — resource owner sets permissions), MAC (Mandatory — system enforces clearance levels), and RBAC (Role-Based — permissions tied to job function). Broken or misconfigured access controls are the root cause of IDOR, privilege escalation, and most data breach incidents.

An attacker gaining full control of a legitimate user account — typically by stealing credentials via phishing, credential stuffing, session hijacking, or authentication bypass. ATO is the end goal of most web application attacks and a top bug bounty finding. The attacker then operates as the victim, evading detection because they use legitimate credentials.

Microsoft's directory service for managing users, computers, and resources in Windows enterprise environments. AD is the primary authentication and authorisation infrastructure in over 90% of enterprises. It is also the single most targeted component in breach operations — Golden Ticket, Silver Ticket, DCSync, Kerberoasting, AS-REP Roasting, and Pass-the-Hash attacks all target AD.

A sophisticated, long-running cyberattack campaign conducted by a well-resourced threat actor — typically a nation-state or state-sponsored group — with specific strategic objectives. APTs prioritise stealth over speed, maintaining access for months or years before executing their mission. Indian-relevant APT groups include APT36 (Transparent Tribe, Pakistan), SideWinder (South Asia), and Lazarus Group (North Korea).

A phishing technique that deploys a reverse proxy between the victim and the legitimate login page. The victim sees and interacts with the real login page, but the attacker's proxy captures both the credentials AND the post-authentication session cookie — bypassing MFA entirely. Evilginx2, Modlishka, and Muraena are common free frameworks. Now the dominant account takeover technique against MFA-protected Microsoft 365 accounts.

Physical isolation of a computer or network from all external connections including the internet, other networks, and even Bluetooth/Wi-Fi. Used for the most sensitive systems — nuclear plant controls, classified government networks, HSMs. Stuxnet demonstrated that air gaps are not impenetrable — they can be bridged via infected USB drives, RF emissions, acoustic signals, and power line communication.

Security software that detects and removes known malware using signature databases (hash matching), heuristic analysis (suspicious behaviour patterns), and increasingly, machine learning models. Legacy AV relies heavily on signatures — it cannot detect novel malware or fileless attacks. Modern EDR products have largely superseded standalone AV in enterprise environments. Threat actors routinely test their malware against VirusTotal before deploying it.

The discipline of securing Application Programming Interfaces — the communication channels modern applications use to exchange data. The OWASP API Security Top 10 defines the most common API vulnerabilities: Broken Object Level Authorization (API IDOR), Broken Authentication, Excessive Data Exposure, and Mass Assignment. APIs are now the dominant attack surface because applications expose more functionality via API than through the UI.

An attack where the attacker sends fake ARP (Address Resolution Protocol) reply packets to associate their MAC address with a legitimate IP — typically the default gateway. Traffic intended for the gateway is redirected to the attacker's machine, enabling man-in-the-middle interception on local networks. Detectable by monitoring for ARP table changes, duplicate ARP replies, or using ARP monitoring tools like arpwatch.

An Active Directory attack targeting accounts with Kerberos pre-authentication disabled. When pre-auth is off, any user can request an AS-REP ticket for that account without authenticating — the ticket is encrypted with the account's password hash. The attacker requests the ticket and cracks it offline with hashcat. Detection: Event ID 4768 with pre-authentication type 0x0.

The total sum of all points where an attacker can try to enter or extract data from an environment. Every internet-exposed service, every API endpoint, every employee email address, every third-party integration, and every software dependency is part of the attack surface. Attack surface reduction — removing unnecessary exposure — is a more effective defence than attempting to secure every exposed point.

The path or means by which an attacker gains access to a target. CVSS defines four attack vectors: Network (exploitable remotely), Adjacent (exploitable from the same network), Local (requires local access), and Physical (requires physical presence). Understanding attack vectors determines detection strategy — a network-exploitable vulnerability needs firewall rules; a local-only vulnerability needs endpoint controls.

A chronological record of events — user actions, system events, security-relevant operations — generated by systems, applications, and security controls. Audit logs are the forensic evidence trail for any incident investigation. The most critical Windows audit log events: 4624/4625 (logon success/failure), 4688 (process creation), 4698 (scheduled task created), 4720 (user account created), 4732 (group membership changed).

The process of verifying that a claimed identity is genuine. The three authentication factors: something you know (password, PIN), something you have (hardware token, phone), something you are (biometric). Multi-factor authentication (MFA) combines two or more factors. Broken authentication is consistently the second-most-common cause of data breaches — weak passwords, credential stuffing, session fixation, and MFA bypass all attack the authentication layer.

Determining what actions an authenticated identity is permitted to perform. Authentication answers "who are you?" — authorisation answers "what are you allowed to do?" Confused with authentication in development leading to broken access control — the most common vulnerability class in the OWASP Top 10. An authorisation failure allows authenticated users to perform actions or access data beyond their permission level.

A covert method of bypassing normal authentication to maintain persistent remote access to a compromised system. Backdoors are planted by attackers after initial compromise to ensure re-entry even if the initial vulnerability is patched. They range from simple bind shells (netcat listener) to sophisticated implants like Cobalt Strike beacons or nation-state RATs (Remote Access Trojans) with encrypted C2 communications.

Regular, scheduled check-in communications from malware to its command and control (C2) server. The beacon interval is the attacker's primary operational parameter — short intervals mean faster response but more detectable traffic. Sophisticated tools like Cobalt Strike add "jitter" (random timing variation) to evade detection. Beacon detection using statistical analysis (RITA — free tool) is a core network threat hunting technique.

The defensive security team responsible for protecting an organisation's infrastructure. Blue team functions include: monitoring and alerting (SOC), incident response (DFIR), threat hunting, security architecture, and vulnerability management. Blue team effectiveness is tested by Red Team operations (simulated attacks) and measured through Purple Team exercises (collaborative attack-defence analysis).

A network of internet-connected devices infected with malware and controlled by a threat actor (bot herder) via a C2 infrastructure. Botnets are used for: DDoS attacks, spam campaigns, credential stuffing, cryptomining, and ransomware distribution. The largest botnets (Emotet, Mirai, TrickBot) infected millions of devices. Botnet C2 infrastructure is tracked by abuse.ch's Feodo Tracker — free and public.

Systematically attempting every possible credential combination until the correct one is found. Pure brute force (trying every character combination) is slow — modern attacks use credential stuffing (trying known password:username pairs from breaches), password spraying (one common password across many accounts to avoid lockout), or dictionary attacks (common passwords and variations). Detection: Event ID 4625 repeated failures, failed auth spikes in SIEM.

A vulnerability where a program writes more data to a buffer than it can hold, overwriting adjacent memory. Exploiting a buffer overflow allows an attacker to overwrite the return address on the stack and redirect execution to attacker-supplied shellcode. The foundation of memory corruption exploitation. Mitigated by: stack canaries, ASLR (Address Space Layout Randomisation), DEP/NX (non-executable memory), and safe programming languages.

A sophisticated social engineering attack where an attacker impersonates a trusted executive, vendor, or partner via email to manipulate an employee into transferring money or sensitive data. BEC is the highest-revenue cybercrime category globally — over $2.9 billion stolen in 2023 per FBI IC3. Common scenarios: CEO fraud (urgent wire transfer), vendor impersonation (changed payment details), payroll diversion. No malware involved — detection requires behavioural email analysis.

A programme where organisations pay security researchers (bounty hunters) to find and responsibly disclose vulnerabilities before malicious actors do. Major platforms: HackerOne, Bugcrowd, Intigriti. Payouts range from $100 for low-severity findings to $1,000,000+ for critical vulnerabilities in top programmes. The CGF Bug Bounty Bootcamp covers the full methodology from recon to report writing.

The infrastructure and protocols attackers use to communicate with malware on compromised systems — sending commands and receiving output. C2 channels range from simple HTTP callbacks to sophisticated protocols disguised as legitimate traffic (DNS tunneling, HTTPS with domain fronting, cloud storage APIs). Disrupting C2 communication kills the attacker's ability to operate. MITRE ATT&CK's Command and Control tactic covers 18 techniques.

A trusted organisation that issues digital certificates binding a public key to an identity. The CA validates the applicant's identity, then signs the certificate with its private key. Browsers and operating systems ship with a list of trusted root CAs. A compromised CA can issue fraudulent certificates for any domain — the DigiNotar breach (2011) demonstrated this catastrophically. Certificate Transparency (CT) logs all issued certificates publicly — attackers and defenders both use this.

The foundational security model: Confidentiality (information is accessible only to authorised parties), Integrity (information is accurate and has not been tampered with), Availability (information and systems are accessible when needed). Every security control maps to one or more of these properties. Ransomware attacks all three simultaneously: encrypting data (confidentiality + integrity) and demanding payment for restoration (availability).

An algorithm for performing encryption and decryption. Stream ciphers (ChaCha20, RC4) encrypt one bit or byte at a time — fast, suitable for real-time communications. Block ciphers (AES, 3DES) operate on fixed-size data blocks — AES-256 in GCM mode is the current gold standard for symmetric encryption. Cipher selection in TLS determines the security of HTTPS connections — weak ciphers (RC4, 3DES, export-grade) enable decryption attacks.

A vulnerability where an attacker can inject operating system commands into a field that is passed to a system shell — typically via user input that is not sanitised before being executed. Severity: Critical. A single command injection vulnerability gives the attacker the ability to execute any command as the web server process — reading files, creating backdoors, or pivoting to internal systems. Detection: logs showing shell metacharacters (;, |, &&, $()) in web requests.

A standardised naming system for publicly disclosed cybersecurity vulnerabilities — every CVE has a unique ID (CVE-YEAR-NUMBER), a description, and references. Maintained by MITRE, funded by CISA. The National Vulnerability Database (NVD) enriches CVEs with CVSS scores and additional metadata. Understanding CVE severity metrics (CVSS base score, attack vector, complexity, impact) is essential for vulnerability prioritisation.

A standardised scoring system for communicating the severity of security vulnerabilities. CVSS v3.1 (current widely-used) scores vulnerabilities 0-10 across three metric groups: Base (inherent characteristics), Temporal (changes over time with patch/exploit availability), Environmental (organisation-specific factors). CVSS 9.0+ = Critical. Limitations: CVSS measures severity, not risk — a Critical CVE in software you don't run is irrelevant. EPSS (Exploit Prediction Scoring System) predicts actual exploitation probability.

Extracting authentication credentials (passwords, hashes, tickets) from memory, the registry, or disk storage. The most targeted location is LSASS (Local Security Authority Subsystem Service) process memory — Mimikatz's sekurlsa::logonpasswords command extracts plaintext passwords and NTLM hashes from LSASS on older Windows versions. Modern defences: Credential Guard, Protected Users group, EDR detection of LSASS access. Detection: Sysmon Event 10 (ProcessAccess targeting lsass.exe).

Automated injection of stolen username/password pairs — sourced from data breaches — against login pages. Because users reuse passwords across sites, a large proportion of stolen credentials still work elsewhere. A breach of one low-value site enables compromise of banking, email, and corporate accounts. Defences: MFA, breach monitoring (HIBP API), rate limiting, device fingerprinting.

An attack that tricks a victim's browser into making an unintended request to a web application where the victim is authenticated. Because the browser automatically includes session cookies, the server processes the request as if the legitimate user made it. A CSRF attack on a banking application's transfer endpoint can initiate unauthorised transfers. Defence: CSRF tokens, SameSite cookie attribute, Origin header validation.

A vulnerability where an attacker injects malicious JavaScript into a web page that other users view. Reflected XSS requires the victim to click a crafted URL. Stored XSS is saved in the database and executes for every user who views the page. DOM-based XSS occurs entirely client-side. Impact ranges from cookie theft (session hijacking → account takeover) to keylogging and phishing overlays. Mitigated by Content Security Policy (CSP), output encoding, and HttpOnly cookie flags.

Unauthorised use of a victim's computing resources to mine cryptocurrency. Delivered via malicious browser scripts (Coinhive was the dominant platform before shutdown), malware droppers, or cloud resource hijacking. Cryptojacking in cloud environments (AWS, Azure, GCP) can generate massive bills for the victim — attackers spin up GPU instances on the victim's account. Detection: unusual CPU/GPU spikes, unexpected cloud spend, DNS queries to known mining pool domains.

A model developed by Lockheed Martin describing the stages of a cyberattack: Reconnaissance → Weaponisation → Delivery → Exploitation → Installation → Command & Control → Actions on Objectives. Understanding the kill chain helps defenders identify the earliest stage at which they can detect and disrupt an attack. Disrupting at Reconnaissance (blocking attacker scanning) is more valuable than detecting at Actions on Objectives (when damage is done). MITRE ATT&CK is a more granular, community-maintained evolution of the kill chain concept.

Evidence-based knowledge about existing or emerging threats — including context, mechanisms, indicators, implications, and actionable advice. CTI is classified by type: Strategic (high-level trends for executives), Operational (specific campaign details for security teams), Tactical (IOCs and TTPs for analysts). Quality CTI answers "so what?" and "what should we do?" not just "here is a list of IP addresses." MISP and OpenCTI are the leading free CTI management platforms.

Parts of the internet not indexed by standard search engines, accessible only via specialised software (primarily Tor). The dark web hosts legitimate privacy-preserving services and criminal marketplaces — stolen credentials, malware-as-a-service, ransomware group data leak sites, and fraud services. Security teams monitor dark web sources for leaked credentials, reconnaissance activity targeting their organisation, and early warning of planned attacks.

The unauthorised transfer of data from a target environment to an attacker-controlled location. Exfiltration channels: HTTPS to cloud services (Dropbox, Google Drive — hard to block), DNS tunneling (encoding data in DNS query names), ICMP tunneling, email (using legitimate SMTP), and physical media. Detection: large outbound data transfers, connections to cloud storage from servers, DNS query length anomalies, data leaving during off-hours.

A credential theft technique that abuses the Domain Controller's replication protocol (MS-DRSR). An attacker with sufficient Active Directory privileges impersonates a DC and requests credential data (NTLM hashes and Kerberos keys) for any account — including the krbtgt account, enabling Golden Ticket creation. Detection: 4662 events with replication permissions from non-DC accounts, or Mimikatz's lsadump::dcsync activity in EDR telemetry.

An attack that overwhelms a target with traffic from many sources simultaneously, rendering it unavailable to legitimate users. Volumetric DDoS floods bandwidth (UDP floods, DNS amplification reaching Tbps levels). Protocol DDoS exhausts connection state (SYN floods). Application DDoS targets specific resource-intensive endpoints (slow HTTP attacks, search queries). Defence: CDN scrubbing, BGP blackholing, rate limiting, anycast diffusion. Hacktivist groups (Anonymous Sudan, Killnet) use DDoS as a geopolitical weapon.

A security architecture principle using multiple independent layers of controls so that failure of any single control does not result in a breach. Originates from military strategy. In practice: perimeter firewall → network segmentation → host firewall → EDR → SIEM alerting → DLP → MFA → least-privilege access. The assumption is that some layers will fail — the goal is to ensure that no single failure is catastrophic.

Three email authentication standards that together prevent domain spoofing and phishing. SPF (Sender Policy Framework) lists authorised sending IPs for a domain. DKIM (DomainKeys Identified Mail) cryptographically signs emails. DMARC (Domain-based Message Authentication) tells receiving servers what to do with emails that fail SPF or DKIM checks (quarantine or reject). Organisations without DMARC p=reject are trivially spoofable — a common phishing enabler.

Encoding data inside DNS queries and responses to exfiltrate data or maintain C2 communications through networks that allow DNS traffic. DNS is often permitted through firewalls that block all other outbound protocols. The encoded data appears as unusually long subdomain labels or high-frequency queries to a single authoritative nameserver. Detection: DNS query length anomalies, high query rates to single nameservers, DNS query types that don't match normal patterns (TXT, NULL records).

A technique using Content Delivery Networks (CDNs) to disguise C2 traffic. The attacker sends HTTPS traffic to a legitimate CDN domain (e.g., cloudfront.net) — so firewall logs show a connection to Amazon — but the HTTP Host header inside the encrypted tunnel routes the request to the attacker's backend. The CDN sees the real Host header after TLS termination. Major CDNs have moved to block domain fronting, but it remains viable on some platforms.

India's Digital Personal Data Protection Act — the primary personal data protection legislation. Requires: valid consent before processing personal data, data minimisation, purpose limitation, grievance redressal mechanisms, and breach notification to the Data Protection Board. Penalties up to ₹250 crore per violation instance. Applies to all entities processing digital personal data of Indian citizens, including foreign entities. Compliance is mandatory for all organisations handling Indian user data.

Security software deployed on endpoints that continuously monitors and records endpoint activity — process creation, network connections, file operations, registry changes, memory allocation — and uses this telemetry to detect and respond to threats. Unlike antivirus (signature-based), EDR detects behavioural anomalies and unknown malware. Leading commercial tools: CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne. Free alternative: Elastic Defend (fully functional with Elastic's free tier).

The process of converting plaintext into ciphertext using a cryptographic algorithm and key, making the data unreadable without the corresponding decryption key. Symmetric encryption (AES) uses the same key for encryption and decryption — fast, suitable for bulk data. Asymmetric encryption (RSA, ECC) uses a public/private key pair — slower, used for key exchange and digital signatures. End-to-end encryption (E2EE) ensures only sender and recipient can read messages — even the service provider cannot.

The systematic process of extracting information from a target system or network — user accounts, network shares, services, applications, DNS records, and system configurations. Enumeration follows reconnaissance and informs subsequent attack phases. Tools: Nmap (port and service enumeration), Gobuster/ffuf (web content enumeration), enum4linux (SMB/NetBIOS enumeration), Subfinder (DNS enumeration). Detection: high-rate connection attempts to multiple ports or endpoints from a single source.

A rogue wireless access point that mimics a legitimate network — same SSID, sometimes stronger signal — to intercept victim connections. Victims who connect have all their traffic intercepted by the attacker. Often deployed in public locations (cafes, airports, conferences). Defence: VPN usage on all networks, certificate validation, 802.1X authentication on corporate Wi-Fi. Detection: multiple APs broadcasting the same SSID with different MAC addresses.

Code or a technique that takes advantage of a software vulnerability to cause unintended behaviour — typically gaining unauthorised access or code execution. Exploits are categorised by vulnerability type (buffer overflow, SQLi, deserialization) and access level achieved (user, admin, kernel/root, SYSTEM). Zero-day exploits target vulnerabilities with no available patch. The Exploit Database (exploit-db.com) and Metasploit Framework catalogue thousands of public exploits.

Using legitimate cloud services (Dropbox, Google Drive, OneDrive, GitHub, Slack, Telegram) to exfiltrate stolen data or as C2 channels. Because these services have valid TLS certificates, are on corporate allow-lists, and blend with legitimate traffic, they are difficult to block without disrupting business operations. Detection requires DLP (Data Loss Prevention) inspection, API monitoring, and unusual outbound data volume analysis.

An alert fired by a security tool for a legitimate, non-malicious event. False positives are the primary cause of alert fatigue — analysts who see 500 alerts per day and 490 are false learn to dismiss alerts. Reducing false positives through tuning (whitelisting known-good behaviour, adjusting thresholds) is essential for an effective SOC. A useful metric: signal-to-noise ratio = true positives / (true positives + false positives).

A genuine threat that a security tool fails to detect — the most dangerous outcome. False negatives are invisible by nature: you don't know what you missed. Measuring false negative rate requires red team exercises, penetration testing, and purple team operations — simulating real attacks and checking whether controls detected them. A SIEM rule that has never fired should be validated, not celebrated.

The current gold standard for phishing-resistant authentication. FIDO2 uses public-key cryptography: the authenticator (hardware security key like YubiKey, or platform authenticator like Windows Hello) stores a private key and signs authentication challenges. The private key never leaves the device. Because the signature is bound to the origin domain, phishing sites cannot intercept and replay credentials. Mandated for high-value accounts in most modern security frameworks.

A network security control that filters traffic based on rules — permitting or denying connections based on source/destination IP, port, protocol, and increasingly application identity (next-generation firewalls). Stateful firewalls track connection state; stateless firewalls evaluate each packet independently. WAF (Web Application Firewall) inspects HTTP traffic specifically. Firewalls are necessary but not sufficient — they do not inspect encrypted traffic contents and cannot detect compromised internal hosts.

Automated software testing technique that sends malformed, unexpected, or random data to an application's inputs to discover crashes, memory corruption, and vulnerabilities. Coverage-guided fuzzers (AFL++, libFuzzer) use code coverage feedback to maximise path exploration. Browser security teams use fuzzing continuously — Google's ClusterFuzz found over 25,000 vulnerabilities in Chrome. Bug bounty hunters use fuzzing against web APIs (ffuf), binary parsers, and protocol implementations.

A Kerberos attack that creates a forged Ticket Granting Ticket (TGT) using the krbtgt account's NTLM hash — allowing authentication as any user, including domain admins, with any privilege level, for up to 10 years. Requires the krbtgt hash from credential dumping (typically via DCSync). The forged ticket bypasses normal authentication and is difficult to detect because it looks like valid Kerberos traffic. Mitigation: rotate krbtgt password twice, monitor for anomalous Kerberos ticket lifetimes.

The integrated approach to organisational governance, risk management, and regulatory compliance. Governance: policies, procedures, accountability structures. Risk: identifying, assessing, and treating security risks. Compliance: meeting regulatory requirements (ISO 27001, CERT-In, DPDP Act, SEBI CSCRF, RBI IT Framework). GRC is the bridge between technical security and business and legal requirements — understanding GRC is essential for senior security roles in India's regulated sectors.

Configuration policies applied to users and computers in an Active Directory environment — controlling security settings, software installation, startup scripts, and hundreds of system parameters. GPOs are a primary hardening mechanism in Windows enterprise environments. Attackers with sufficient AD privileges can modify GPOs to push malicious configurations (scheduled tasks, startup scripts) to thousands of machines simultaneously. Detection: 5136/5137 events (Directory Service Object modified/created).

The process of reducing an attack surface by removing unnecessary services, closing unused ports, applying security configurations, and disabling features not required for business function. Security benchmarks (CIS Benchmarks, DISA STIGs) provide prescriptive hardening guidance for every major operating system and application. Key Windows hardening: disable LLMNR/NBT-NS, enforce SMB signing, disable deprecated protocols (NTLMv1, SSLv3), enable Windows Credential Guard, restrict PowerShell execution policy.

A one-way mathematical function that converts input of any size to a fixed-size output (digest). Cryptographic hash functions (SHA-256, SHA-512) have three key properties: deterministic (same input always produces same output), pre-image resistant (cannot reverse the hash to find the input), and collision resistant (infeasible to find two inputs with the same hash). Hashes are used for file integrity verification, password storage (with salt), and digital signatures. MD5 and SHA-1 are cryptographically broken — never use for security purposes.

A decoy system or resource designed to attract attackers, detect intrusion attempts, and collect intelligence on attacker techniques. Low-interaction honeypots simulate services and log connection attempts. High-interaction honeypots are real systems that record full attacker activity. A canary token (canarytokens.org — free) is a lightweight honeypot — a URL, file, or credential that generates an alert when accessed. Any access to a honeypot is a high-confidence indicator of malicious activity.

An HTTP response header that instructs browsers to only connect to the server via HTTPS — never HTTP — for a specified duration. Prevents protocol downgrade attacks (SSLstrip) where an attacker intercepts an HTTP redirect to HTTPS. For full protection, include subdomains and preload the domain in browser HSTS lists. A missing HSTS header is a commonly paid finding on bug bounty programmes.

A five-level model (HMM-0 to HMM-4) assessing an organisation's threat hunting capability. Level 0: purely reactive, alert-driven. Level 1: IOC-based hunting from threat feeds. Level 2: TTP-based hunting mapped to ATT&CK. Level 3: hypothesis-driven hunting with internally developed hunt procedures. Level 4: machine-assisted hunting with automated data collection and detection engineering. The CGF Threat Hunting Bootcamp builds skills from Level 0 through Level 3.

The framework of policies, processes, and technologies ensuring the right people have the right access to the right resources. Core IAM functions: provisioning (creating accounts), authentication (verifying identity), authorisation (enforcing permissions), and de-provisioning (removing access). In cloud environments, IAM misconfigurations are the most common cause of cloud breaches — overpermissive IAM roles in AWS are routinely exploited for privilege escalation.

A vulnerability where an application uses a user-controllable value (ID, UUID, filename) to directly reference an object without verifying the requesting user is authorised to access it. Changing user_id=123 to user_id=124 in a request and receiving another user's data is a textbook IDOR. The most consistently paid vulnerability class in bug bounty hunting. The OWASP API Security Top 10 renamed this "Broken Object Level Authorization" (BOLA) for API contexts.

The structured process for managing the aftermath of a security breach or attack. The NIST IR lifecycle: Preparation → Detection & Analysis → Containment, Eradication & Recovery → Post-Incident Activity. India-specific requirement: CERT-In Directions 2022 mandate reporting of specific incident types within 6 hours of detection. IR quality determines the difference between a minor incident and a catastrophic breach — speed and methodical process are equally important.

Forensic evidence that an intrusion has occurred — IP addresses of C2 servers, malware file hashes, malicious domains, registry keys created by malware, suspicious process names. IOCs are point-in-time and expire as attackers change infrastructure. Indicators of Attack (IOA) — behavioural patterns like "process injection followed by network connection" — are more durable. Pyramid of Pain (David Bianco) ranks IOC types by how difficult they are for attackers to change: hash (trivial) → IP → domain → network artefacts → host artefacts → TTPs (very hard).

A threat originating from current or former employees, contractors, or business partners who misuse their authorised access — maliciously (data theft, sabotage) or accidentally (misconfiguration, social engineering victim). Insider threats are harder to detect than external attacks because insiders already have legitimate access. Detection relies on UEBA (User and Entity Behaviour Analytics) — baselining normal behaviour and alerting on deviations such as mass downloads, unusual access times, or access to unrelated data.

Intrusion Detection System monitors network traffic for suspicious patterns and alerts. Intrusion Prevention System does the same but can also block or reset suspicious connections. Signature-based IDS/IPS (Snort, Suricata) match traffic against known attack patterns. Anomaly-based IDS/IPS establish a baseline and alert on deviations. NIDS (Network IDS) inspects traffic at the network level. HIDS (Host IDS) monitors individual systems. Suricata and Snort are leading free open-source options with thousands of community rules.

The first stage of an attack where the adversary gains an initial foothold in the target environment. MITRE ATT&CK documents 10 initial access techniques including: phishing (most common), exploitation of public-facing applications, valid accounts (credential theft or purchase), supply chain compromise, hardware additions, and drive-by compromise. Detection at initial access is the most cost-effective point — the attacker has the least knowledge of the environment and the fewest tools deployed.

A compact, URL-safe token format used for authentication and information exchange between parties. A JWT has three base64-encoded sections: Header (algorithm type), Payload (claims — user ID, role, expiry), and Signature (verification). Security issues arise from implementation errors: the "alg:none" attack (unsigned tokens accepted), algorithm confusion (RS256 to HS256 confusion), weak signing secrets cracked by hashcat, and kid (key ID) injection. JWT attacks are a consistently paid bug bounty finding — the JWT Editor Burp extension (free) automates testing.

A privilege access management approach that grants elevated permissions only when needed, for a limited time, for a specific purpose — then automatically removes them. Eliminates standing privileges that create persistent attack surface. If an account with JIT admin access is compromised, the attacker only has a narrow window to exploit elevated permissions. Widely adopted in cloud environments (AWS, Azure PIM) as a core Zero Trust control.

The authentication protocol used in Active Directory environments. Kerberos uses symmetric key cryptography and a trusted third party (Key Distribution Centre / KDC) to authenticate users without transmitting passwords over the network. A user authenticates to the KDC and receives a Ticket Granting Ticket (TGT) encrypted with the krbtgt hash. The TGT is then used to request Service Tickets for specific resources. Kerberos is the target of several major attack techniques: Kerberoasting, AS-REP Roasting, Golden Ticket, Silver Ticket, and Pass-the-Ticket.

An Active Directory privilege escalation technique targeting service accounts with Service Principal Names (SPNs). Any authenticated domain user can request a Kerberos Service Ticket for any SPN — the ticket is encrypted with the service account's password hash. The attacker requests the ticket and takes it offline to crack with hashcat. Service accounts often have weak passwords and high privileges. Detection: Event ID 4769 with encryption type 0x17 (RC4) from unusual accounts.

A model describing the sequential stages of a cyberattack. Lockheed Martin's Cyber Kill Chain (2011) is the original: Reconnaissance → Weaponisation → Delivery → Exploitation → Installation → C2 → Actions on Objectives. Each stage represents a detection and disruption opportunity — the earlier the better. MITRE ATT&CK is a more granular evolution, mapping hundreds of techniques across 14 tactics. Defenders use kill chain models to assess which stages they can detect and which they cannot.

Software or hardware that records keystrokes — capturing passwords, credit card numbers, private messages, and all typed content. Software keyloggers are often bundled with other malware. Hardware keyloggers are physical devices inserted between keyboard and computer — undetectable by software. Detection: EDR monitoring for API hooking (SetWindowsHookEx) used by software keyloggers, user training to recognise physical device tampering.

The techniques attackers use to progressively move through a network after gaining initial access — pivoting from the initially compromised host to other systems. Methods include: Pass-the-Hash (reusing NTLM hashes), Pass-the-Ticket (reusing Kerberos tickets), PsExec (remote execution via admin shares), WMI and PowerShell remoting, and RDP. Lateral movement is how a single compromised endpoint becomes a domain-wide breach. Network segmentation and least-privilege access limit lateral movement's blast radius.

Using legitimate, pre-installed system tools for malicious purposes to evade detection — because security tools may not alert on trusted binaries. Windows LoLBins include: PowerShell, cmd.exe, certutil.exe (file download), mshta.exe (HTML application execution), regsvr32.exe (COM object execution), wmic.exe, and bitsadmin.exe. The LOLBAS Project (lolbas-project.github.io) catalogues every Windows binary that can be abused. Detection requires behavioural analysis of what the binaries are doing, not just their names.

The Windows process responsible for enforcing security policy and managing authentication. LSASS stores cached credentials in memory — NTLM hashes, Kerberos tickets, and in some configurations plaintext passwords. It is the primary target for credential dumping tools like Mimikatz. Protections: Protected Process Light (PPL) for LSASS, Windows Credential Guard (virtualisation-based isolation), and EDR monitoring of LSASS memory access. Detection: Sysmon Event 10 (ProcessAccess) targeting lsass.exe.

The process of reviewing, correlating, and querying log data to detect security events, investigate incidents, and ensure compliance. Effective log analysis requires: collection (getting logs to a central SIEM), normalisation (converting different formats to a common schema), correlation (linking related events across sources), and detection (matching events against known attack patterns). The key skill for SOC analysts is writing effective SIEM queries (KQL for Sentinel/Elastic, SPL for Splunk) to surface relevant events from millions of log entries.

Any software designed to disrupt, damage, or gain unauthorised access to a computer system. Major categories: Virus (self-replicating, attaches to files), Worm (self-propagating across networks), Trojan (masquerades as legitimate software), Ransomware (encrypts files, demands payment), Spyware (covertly collects information), Adware (unwanted advertising), Rootkit (hides attacker presence at OS or firmware level), Cryptominer (uses resources to mine cryptocurrency), and Fileless malware (operates entirely in memory).

An attack where the attacker secretly intercepts and potentially alters communication between two parties who believe they are communicating directly. Techniques: ARP poisoning (LAN), SSL stripping (downgrade HTTPS to HTTP), rogue AP (wireless), BGP hijacking (internet-scale routing manipulation). HTTPS, HSTS, certificate pinning, and mutual TLS (mTLS) are primary defences. "On-path attack" is the newer preferred term because the attacker is not always in the middle topologically.

The acquisition and analysis of a computer's volatile memory (RAM) to extract forensic evidence that does not exist on disk — running processes (including injected code), network connections, decrypted data, encryption keys, user credentials, and attacker tools. Volatility 3 (free, open-source) is the primary memory forensics framework. Key plugins: pslist (process list), netscan (network connections), malfind (injected code detection), dumpfiles (extract files from memory).

A globally accessible, community-maintained knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations. Organised into 14 tactics (the adversary's goals: Initial Access through Impact) containing 200+ techniques and 400+ sub-techniques. ATT&CK enables a common language for describing attacker behaviour, helps defenders identify detection gaps, and supports threat intelligence sharing. Three matrices: Enterprise (Windows/Mac/Linux/Cloud), Mobile, and ICS.

Authentication requiring two or more independent factors: something you know (password), something you have (phone/hardware key), something you are (biometric). MFA prevents most credential-based attacks — even if an attacker has a password, they cannot authenticate without the second factor. However, MFA is not impenetrable: OTP-based MFA is vulnerable to AiTM phishing and real-time phishing. Phishing-resistant MFA (FIDO2/WebAuthn, hardware keys) is the only type that fully prevents AiTM attacks.

An open-source tool created by Benjamin Delpy that extracts credentials from Windows memory. sekurlsa::logonpasswords extracts NTLM hashes and plaintext passwords from LSASS. kerberos::golden creates Golden Tickets. lsadump::dcsync replicates DC credentials. Originally a proof-of-concept for Windows credential storage weaknesses, Mimikatz became the standard post-exploitation credential harvesting tool used by both attackers and red teamers. Its signatures are well-known — attackers use obfuscated variants.

A mass exploitation event where the Cl0p ransomware group exploited a zero-day SQL injection vulnerability (CVE-2023-34362) in Progress Software's MOVEit Transfer file transfer application. Over 2,500 organisations globally were breached including government agencies, airlines, banks, and universities — affecting over 66 million people. The attack was entirely automated — Cl0p had pre-positioned their exploitation script before disclosure and ran it simultaneously across thousands of targets.

Dividing a network into isolated zones with restricted communication between them — limiting the blast radius of a breach. A compromised workstation in a properly segmented network cannot directly reach production servers, domain controllers, or OT systems. Implementation: VLANs, internal firewalls, micro-segmentation (software-defined policies per workload), and Zero Trust Network Access (ZTNA). The Purdue Model is the standard segmentation architecture for OT/ICS environments.

A voluntary framework providing guidance for managing cybersecurity risk. CSF 2.0 (2024) has six functions: Govern (new in 2.0), Identify, Protect, Detect, Respond, Recover. Each function contains categories and subcategories mapping to specific controls. The NIST CSF is referenced in India's CERT-In guidelines and adopted by many Indian organisations as a risk management baseline alongside ISO 27001.

Security technology that monitors network traffic to detect threats, investigate incidents, and respond — complementing EDR (endpoint-focused) with network-layer visibility. NDR analyses NetFlow, PCAP, and protocol metadata using ML models and signature detection. Critical for detecting: C2 beaconing, lateral movement over SMB/RDP/WMI, data exfiltration volumes, and encrypted traffic anomalies (without decryption). Zeek (free, open-source) is the foundation of many NDR deployments.

A security property ensuring that a party cannot deny having performed an action. Digital signatures provide non-repudiation for electronic communications — only the holder of the private key could have signed the message, providing cryptographic proof of authorship. In audit and forensics contexts, tamper-evident audit logs provide non-repudiation of system events. Critical for legal and compliance contexts where actions must be attributable to specific individuals.

An authorisation framework that allows a user to grant a third-party application limited access to their account on another service without sharing their password. The user authorises the third-party app through the identity provider (e.g., "Login with Google"), which issues an access token. Security issues: missing state parameter (CSRF against OAuth flow), open redirect in redirect_uri (code theft), insufficient scope validation (privilege escalation). OAuth misconfigurations consistently produce High-severity bug bounty findings.

Intelligence gathered from publicly available sources — websites, social media, public records, satellite imagery, domain registration data, and certificate transparency logs. Used by: threat actors (reconnaissance), security researchers (attack surface mapping), investigators (threat actor attribution), and journalists (verification). Key tools: Maltego CE, Shodan, Amass, theHarvester, crt.sh, SpiderFoot — all free. The CGF OSINT Masterclass covers the complete methodology across 7 phases.

The Open Worldwide Application Security Project's authoritative ranking of the 10 most critical web application security risks — updated every 3-4 years based on data from thousands of real-world applications. The 2021 list: Broken Access Control, Cryptographic Failures, Injection, Insecure Design, Security Misconfiguration, Vulnerable and Outdated Components, Identification and Authentication Failures, Software and Data Integrity Failures, Security Logging and Monitoring Failures, SSRF. The OWASP API Security Top 10 extends this to API-specific risks.

A lateral movement technique where an attacker uses a captured NTLM password hash to authenticate to network services without knowing the actual plaintext password. Because Windows NTLM authentication uses the hash directly (not the password), a stolen hash is as good as the password. Tools: Mimikatz sekurlsa::pth, Impacket wmiexec/smbexec. Mitigation: Windows Defender Credential Guard, network logon restrictions, LAPS for local admin passwords, disabling NTLMv1.

A lateral movement technique using stolen Kerberos tickets (TGT or Service Tickets) to authenticate to services. Unlike Pass-the-Hash (NTLM), PtT works in environments that have disabled NTLM. Tickets are extracted from LSASS memory using Mimikatz (kerberos::list /export). Mitigation: short Kerberos ticket lifetimes, Protected Users security group (prevents TGT caching), and anomaly detection for ticket-based authentication from unusual hosts.

An authorised, simulated cyberattack against a target system performed to evaluate its security posture. Methodology follows structured phases: Reconnaissance → Scanning → Exploitation → Post-Exploitation → Reporting. Distinct from vulnerability scanning (automated, no exploitation) and red teaming (broader, simulates real threat actors over extended periods). Output: a report with confirmed vulnerabilities, proof-of-concept evidence, business impact assessment, and remediation recommendations.

Techniques attackers use to maintain access to a compromised system across restarts, credential changes, and other interruptions. Common Windows persistence mechanisms: scheduled tasks (T1053.005), registry Run keys (T1547.001), services (T1543.003), WMI event subscriptions (T1546.003), startup folder shortcuts (T1547.001), and DLL search order hijacking (T1574.001). Detection: PersistenceSniper (free Velociraptor artifact) checks 80+ persistence locations fleet-wide.

A social engineering attack using fraudulent communications — typically email — that appears to come from a trusted source to deceive recipients into revealing credentials, clicking malicious links, or opening malware-laden attachments. Spear phishing targets specific individuals with personalised content. Whaling targets senior executives. Vishing uses voice calls. Smishing uses SMS. DMARC p=reject prevents domain spoofing. User training reduces susceptibility but cannot eliminate it — technical controls are essential.

Cryptographic algorithms designed to resist attacks from quantum computers, which can break RSA and ECC using Shor's algorithm. NIST finalised three PQC standards in 2024: ML-KEM (FIPS 203 — key encapsulation), ML-DSA (FIPS 204 — digital signatures), and SLH-DSA (FIPS 205 — hash-based signatures). Organisations must begin cryptographic inventory and migration planning now because of the "Harvest Now Decrypt Later" (HNDL) threat — adversaries are already collecting encrypted traffic today to decrypt once quantum computers are available.

Gaining higher access levels than initially obtained — moving from a standard user account to administrator/root/SYSTEM. Vertical escalation: gaining higher privileges than assigned. Horizontal escalation: gaining access to another account at the same privilege level (essentially IDOR for authentication). Techniques: exploiting SUID binaries (Linux), token impersonation (Windows), UAC bypass, sudo misconfigurations, and overpermissive IAM policies (cloud). Detection: unexpected processes running as SYSTEM/root, unusual privilege usage patterns.

Techniques for running malicious code within the address space of a legitimate process, hiding the attacker's activity under trusted process names. Variants: DLL injection, reflective DLL injection, process hollowing (empty a legitimate process and replace with malicious code), thread hijacking, CreateRemoteThread injection, and APC injection. Commonly used to run shellcode inside explorer.exe, svchost.exe, or other trusted processes. Detection: Sysmon Event 8 (CreateRemoteThread) and Event 10 (ProcessAccess).

Quantum computers can solve certain mathematical problems exponentially faster than classical computers. Shor's algorithm (runnable on a sufficiently capable quantum computer) breaks RSA, ECC, and Diffie-Hellman by solving the integer factoring and discrete logarithm problems. Grover's algorithm halves the effective key length of symmetric encryption — AES-128 becomes AES-64-equivalent. The "cryptographically relevant quantum computer" (CRQC) capable of breaking RSA-2048 is estimated to be 5-15 years away — planning should begin now.

A modular banking trojan and botnet that evolved into a malware distribution platform — delivering ransomware (Black Basta, Conti, REvil) to corporate targets. Delivered via phishing emails with malicious Office documents or password-protected ZIPs. Features: credential theft, lateral movement via WMI and PsExec, and network propagation. US DOJ disrupted QakBot infrastructure in August 2023, but the threat actor resumed operations in late 2023. Still active.

A precomputed table of password hashes used to reverse hash functions and recover plaintext passwords. Given a hash, look it up in the table — if it's there, the plaintext is known. Effective against unsalted hashes. Countered by password salting — adding a unique random value to each password before hashing, making precomputed tables useless. Modern password hashing (bcrypt, Argon2, PBKDF2) includes salting by design — MD5 and SHA-1 without salting are trivially cracked with rainbow tables.

Malware that encrypts a victim's files and demands payment for the decryption key. Modern ransomware operations are conducted by organised criminal groups operating as "Ransomware as a Service" (RaaS) — developers build and maintain the ransomware, affiliates conduct the attacks and share revenue. Double extortion: encrypt AND steal data, threaten to publish. Triple extortion: add DDoS or contact customers/partners. Prevention: offline backups, network segmentation, EDR, MFA. India is the third most targeted country for ransomware globally.

A vulnerability class allowing an attacker to execute arbitrary code on a target system over a network without physical access. RCE is universally considered Critical severity — complete compromise of the affected system. Common causes: deserialization vulnerabilities, command injection, buffer overflows, template injection (SSTI), and memory corruption bugs. RCE vulnerabilities in widely-used software (Log4Shell in Log4j, EternalBlue in Windows SMB) can affect millions of systems simultaneously.

A group that simulates real threat actors — using the same tools, techniques, and procedures (TTPs) as actual adversaries — to test an organisation's detection and response capabilities. Red team operations are adversary simulations with defined objectives (e.g., access the domain controller) over extended periods (weeks to months), unlike penetration tests which focus on finding all vulnerabilities in a defined scope. Red team findings drive Blue Team improvement through Purple Team exercises.

Malware designed to hide its presence and other malicious software from the operating system and security tools. User-mode rootkits hook OS APIs to filter out their own files and processes from listings. Kernel-mode rootkits operate at the highest privilege level, modifying the OS kernel itself. Bootkit rootkits infect the boot sector, loading before the OS. UEFI rootkits (CosmicStrand, MoonBounce) persist even after OS reinstallation and disk replacement. Detection requires memory forensics or hardware integrity verification.

A platform that collects, aggregates, normalises, correlates, and analyses log data from across an organisation's technology stack — generating alerts when suspicious patterns match detection rules. Core SIEM functions: log collection, event correlation, alerting, dashboarding, and forensic investigation. Leading platforms: Microsoft Sentinel (cloud), Splunk, IBM QRadar, Elastic Security (free tier). The quality of a SIEM is determined by the quality of its detection content — poorly tuned rules produce alert fatigue; well-tuned rules surface real threats.

A generic, vendor-agnostic signature format for SIEM detection rules. A Sigma rule is a YAML file describing a detection pattern that can be converted to any SIEM's native query language (KQL, SPL, YARA-L, SQL) using sigma-cli. The SigmaHQ community repository (github.com/SigmaHQ/sigma) maintains 3,000+ free rules covering every major ATT&CK technique. Writing detections in Sigma means write once, deploy anywhere — the standard for detection engineering teams.

A platform that automates security workflows — collecting alerts from multiple sources, enriching them with contextual data, executing response playbooks, and reducing analyst workload. A SOAR playbook for a phishing alert might: automatically extract IOCs, check them against threat intelligence, quarantine the affected endpoint, send a notification to the analyst, and open a case — all without human intervention. Reduces mean time to respond (MTTR) from hours to minutes.

The team and infrastructure responsible for continuous monitoring, detection, analysis, and response to security incidents. SOC analysts are typically tiered: Tier 1 (alert triage and initial analysis), Tier 2 (incident investigation and escalation), Tier 3 (threat hunting and advanced analysis). SOC metrics: MTTD (Mean Time to Detect), MTTR (Mean Time to Respond), alert volume, false positive rate, and incidents resolved per analyst. The CGF SOC Analyst Bootcamp is a 365-day comprehensive training programme.

Psychological manipulation of people into performing actions or divulging information that serves the attacker's goals — bypassing technical security controls by targeting the human element. Techniques: phishing (email), vishing (voice), smishing (SMS), pretexting (fabricated scenarios), baiting (malicious USB drives), and quid pro quo (offering help in exchange for information). The most successful social engineering attacks are highly researched and personalised — using OSINT to make the scenario credible.

A vulnerability where user-supplied input is concatenated directly into SQL queries without sanitisation, allowing attackers to manipulate database queries. A single apostrophe in an input field causing a database error is the classic detection indicator. Impact ranges from authentication bypass (login without credentials) to full database extraction, and in some configurations, OS command execution (xp_cmdshell in MSSQL). Completely preventable with parameterised queries (prepared statements) — there is no excuse for SQLi in new code.

A vulnerability where an attacker can cause a server to make HTTP requests to an attacker-specified destination. If a web application fetches a URL based on user input, injecting http://169.254.169.254/latest/meta-data/ redirects the server's request to AWS Instance Metadata — potentially returning IAM credentials. Internal services (databases on 127.0.0.1, internal APIs on 10.x.x.x) that are not accessible externally become reachable via SSRF. Consistently rated Critical on cloud applications.

An attack targeting an organisation by compromising a supplier, vendor, or partner that has trusted access. Attackers compromise a software update mechanism (SolarWinds Orion), a widely-used library (event-stream npm package), a managed service provider with access to multiple clients, or hardware during manufacturing. Highly effective because defenders implicitly trust software from known vendors. Detection requires software composition analysis (SCA), code signing verification, and monitoring of third-party software behaviour.

Microsoft's free System Monitor — a Windows service and driver that logs detailed system activity to the Windows Event Log. Key events: Process creation with full command line and parent (Event 1), Network connections with process association (Event 3), LSASS memory access for credential dumping detection (Event 10), CreateRemoteThread for injection detection (Event 8), DNS queries (Event 22), Registry modifications (Event 13). With a good configuration (SwiftOnSecurity config — free), Sysmon transforms Windows logging from coarse to forensic-quality.

Any individual, group, or organisation that conducts malicious cyber activities. Classification by motivation: Nation-State (strategic intelligence, sabotage, espionage — APT groups), Cybercriminal (financial gain — ransomware, BEC, fraud), Hacktivist (ideological — DDoS, defacement), Insider (current/former employee), and Script Kiddie (unsophisticated, using others' tools). Attribution is difficult and imprecise — focus on TTPs rather than actor identity for defensive purposes.

The proactive, analyst-driven search for threats that have evaded automated detection — operating on the assumption that adversaries are already inside the environment. Hunters develop hypotheses based on threat intelligence and environmental knowledge, then systematically query log data to confirm or refute them. Distinct from alert investigation (reactive) and red teaming (offensive). The CGF Threat Hunting Bootcamp covers the full 270-day programme from hypothesis development through detection engineering.

See Cyber Threat Intelligence (CTI).

Modifying a file's metadata timestamps (creation, modification, access) to disguise malicious activity or complicate forensic timeline reconstruction. An attacker who drops malware at 02:00 may change the file's timestamp to 09:00 when legitimate users are active, or to a date years in the past. Detection: Sysmon Event 2 captures timestamp change events. NTFS stores timestamps in both the $STANDARD_INFORMATION and $FILE_NAME attributes — timestomping typically only modifies $STANDARD_INFORMATION, leaving $FILE_NAME intact as forensic evidence.

Malware disguised as legitimate software — named after the Trojan Horse. Unlike viruses and worms, Trojans do not self-replicate; they rely on social engineering for distribution. Categories: RAT (Remote Access Trojan — full remote control), banking Trojan (credential theft from financial sites), dropper (downloads and installs other malware), and downloader. Modern Trojans (QakBot, Emotet, TrickBot) act as initial access vehicles that then deliver ransomware or other payloads.

The methods and patterns of behaviour used by threat actors. Tactics are high-level goals (Initial Access, Persistence, Exfiltration). Techniques are the specific methods used to achieve each tactic (Spear Phishing, Scheduled Task, C2 over HTTPS). Procedures are the specific implementation of a technique by a particular actor (e.g., APT29's specific use of PowerShell Empire with custom C2 profiles). TTPs are far more durable than IOCs — actors change IPs and domains daily but rarely change their fundamental techniques.

Registering domains with names similar to legitimate sites — exploiting typographical errors (gooogle.com, paypa1.com) or homographic substitution (using lookalike Unicode characters). Used for phishing, malware distribution, and credential harvesting. In software supply chain attacks, attackers publish packages to npm or PyPI with names one character off from popular packages — developers who mistype the package name install malware. Certificate Transparency logs reveal newly registered lookalike domains in real time.

A Windows security feature requiring explicit approval for privileged operations — preventing software from making changes to the system without user consent. Standard users see a credential prompt; administrators see a consent prompt. UAC bypass techniques exploit Windows mechanisms to elevate privileges without the prompt appearing: fodhelper.exe, eventvwr.exe, mock trusted directories, and COM object elevation abuse. Detection: Sysmon process creation events showing high-integrity processes spawned from unusual parents.

Security analytics that establishes baseline behavioural profiles for users and entities (devices, applications), then alerts on statistically significant deviations. Examples: a user who normally logs in from Mumbai logging in from a different country at 3 AM, a service account that suddenly starts accessing hundreds of file shares, or a server that begins making external DNS queries it has never made before. UEBA is the primary tool for insider threat detection and advanced persistent threat discovery.

A known vulnerability for which a security patch exists but has not been applied to affected systems. Unpatched vulnerabilities are responsible for the majority of successful cyberattacks — organisations are typically breached via CVEs with patches available for months or years. Effective vulnerability management requires: regular scanning, prioritisation by CVSS and EPSS scores, and time-bound patching SLAs (Critical: 24-72 hours, High: 7-14 days, Medium: 30 days).

A free, open-source endpoint visibility, hunting, and DFIR platform. Deploys a lightweight agent to every endpoint and allows analysts to run VQL (Velociraptor Query Language) queries fleet-wide in real time — querying running processes, network connections, persistence mechanisms, and forensic artefacts across thousands of endpoints simultaneously. Used for threat hunting, incident response, and compliance. Maintained by Rapid7 (free/open-source). Arguably the most powerful free endpoint security tool available.

Voice phishing — social engineering conducted by phone call. Attackers impersonate IT support, bank employees, government officials, or executives to extract credentials, OTP codes, or sensitive information. AI voice cloning has dramatically lowered the barrier — attackers now clone executive voices from public audio to conduct ultra-convincing CEO fraud calls. Defence: voice callback verification using known numbers, strict out-of-band verification for sensitive requests.

The leading open-source memory forensics framework. Volatility 3 (free, Python-based) analyses memory dumps from Windows, Linux, and macOS systems. Key plugins: windows.pslist (process list), windows.netscan (network connections), windows.malfind (suspicious memory regions — process injection detection), windows.dumpfiles (extract files from memory), windows.cmdline (process command lines), and windows.registry.userassist (recently executed programs). The CGF DFIR Bootcamp covers Volatility 3 extensively.

A technology creating an encrypted tunnel between a device and a remote server, masking the user's real IP address and encrypting their internet traffic. Corporate VPNs provide secure access to internal resources. Consumer VPNs provide privacy from ISPs and local network observers. From a security perspective, VPNs are: used by attackers to hide their location, used by defenders to secure remote work, and legitimate split-tunnelling configurations can create security gaps. VPN infrastructure itself is a frequent attack target — Pulse Secure, Fortinet, and Citrix VPN vulnerabilities have been heavily exploited.

A weakness in a system, application, process, or person that can be exploited to cause harm. Software vulnerabilities stem from: coding errors (buffer overflows, injection flaws), design flaws (broken authentication logic), configuration errors (default credentials, unnecessary services), and third-party component weaknesses. The vulnerability lifecycle: discovery → CVE assignment → vendor patch → public disclosure → exploitation. Zero-day vulnerabilities are exploited before a patch exists.

A security control that monitors, filters, and blocks HTTP traffic to and from web applications — protecting against common web attacks (SQLi, XSS, CSRF, path traversal). WAFs operate by inspecting HTTP requests against rulesets. Cloud WAFs (AWS WAF, Cloudflare, Azure Front Door WAF) are increasingly common. WAFs are important but not complete protection — they can be bypassed by encoding, unusual HTTP methods, or zero-day techniques. Defence-in-depth requires WAF plus secure code plus vulnerability testing.

Infecting a website frequently visited by the intended victims, then using the compromised site to deliver malware to those visitors. The attacker researches the target group's online habits, compromises a site they regularly visit (an industry forum, a vendor's site, a regional news site), and plants malware that exploits visitors' browsers. More targeted than broad phishing campaigns. Detection: unusual network connections after specific web visits, browser exploit indicators in EDR telemetry.

A highly targeted form of spear phishing aimed at senior executives (CEO, CFO, Board members). Whale phishing emails are meticulously crafted using OSINT — referencing real meetings, projects, and relationships. The goal is typically financial fraud (wire transfer), credential theft for business intelligence, or malware installation with network-wide impact. The attacker invests significant time in the target because the return (executive credentials, large transfers) justifies it.

A Windows administration framework providing a standardised interface for managing system components. Attackers abuse WMI for: remote execution (wmic.exe process call create), persistence (WMI event subscriptions that survive reboot — T1546.003), and lateral movement (remote WMI queries). WMI event subscriptions bind an event filter (trigger condition) to a consumer (action) — allowing malware to execute when specific conditions occur without creating files on disk. Detection: WMI activity logs, Sysmon WMI events.

Self-replicating malware that spreads across networks without requiring user interaction — exploiting vulnerabilities in network services to propagate autonomously. The most destructive historical examples: WannaCry (2017 — EternalBlue exploit, 300,000 systems in 150 countries), NotPetya (2017 — estimated $10 billion in damages), and Morris Worm (1988 — first major internet worm). Modern ransomware often includes worm-like propagation components using credential reuse and SMB exploits.

An evolution of EDR that integrates telemetry from multiple security layers — endpoint, network, cloud, email, and identity — into a unified detection and response platform. XDR correlates data across these sources to detect attacks that span multiple vectors (e.g., phishing email → endpoint compromise → lateral movement → cloud access). Reduces the need to manually correlate alerts from separate tools. Leading platforms: Microsoft Defender XDR, Palo Alto Cortex XDR, CrowdStrike Falcon XDR.

A vulnerability where an XML parser processes external entity declarations in user-supplied XML input — potentially reading local files (e.g., /etc/passwd, application config files), performing SSRF (the parser fetches external URLs), or causing denial of service. Present when applications accept XML and the parser is not configured to disable external entity processing (the default in many older parsers). Detection: unusual file access patterns, outbound requests from XML-processing services.

A pattern-matching tool designed for malware researchers to identify and classify malware samples. A YARA rule defines a set of strings (text, hex, or regular expressions) and conditions — a file matching the rule is flagged. Used for: malware identification, threat hunting across filesystems, sandbox detection, and EDR detection rules. The YARA community maintains thousands of free rules for every known malware family. Hybrid-Analysis and VirusTotal support YARA rule submission.

An extension of YARA developed by Google for use in Google Chronicle (now Google Security Operations). YARA-L adds temporal and statistical reasoning to YARA's pattern matching — allowing rules that fire when a pattern occurs N times within a time window, or when patterns occur in sequence. Represents the evolution of detection rule languages toward multi-event temporal correlation, similar to Elastic's EQL.

A powerful open-source network analysis framework that passively monitors network traffic and generates rich, structured logs — conn.log (all connections), dns.log (all DNS queries), http.log (HTTP requests), ssl.log (TLS connections), files.log (file transfers). Zeek is the data foundation for network threat hunting, C2 detection with RITA, and network forensics. The CGF Threat Hunting Bootcamp covers Zeek deployment and analysis extensively.

A vulnerability that is unknown to the software vendor and has no available patch — "zero days" for defenders to prepare. Zero-day exploits are extremely valuable and typically used by nation-state actors in highly targeted operations. After discovery, the responsible disclosure process (notifying the vendor privately before public disclosure) begins. Zero-day brokers (Zerodium, Crowdfence) purchase zero-days for hundreds of thousands to millions of dollars for sale to governments.

A security model based on the principle "never trust, always verify" — eliminating implicit trust based on network location. Every access request is authenticated, authorised, and continuously validated regardless of whether it originates inside or outside the network perimeter. The five pillars of Zero Trust: Identity, Devices, Networks, Applications, and Data. CISA's Zero Trust Maturity Model defines implementation stages. Contrasts with the castle-and-moat model where inside = trusted.

A technology implementing Zero Trust for network access — replacing traditional VPN with identity and context-aware application-level access. Unlike VPN (which grants broad network access once connected), ZTNA grants access only to specific applications based on user identity, device health, location, and behaviour. Users cannot see or reach resources they are not explicitly authorised to access. Major implementations: Cloudflare Access (free tier), Zscaler Private Access, Google BeyondCorp.

A cryptographic method allowing one party to prove they know a value (a secret, a credential, a password) without revealing the value itself. Applications in cybersecurity: authentication without transmitting passwords, anonymous credential verification, and privacy-preserving identity systems. Increasingly relevant as privacy regulations (DPDP Act) require minimising personal data exposure while still verifying identity attributes.